PingOne Attack Paths

This post presents PingOneHound, a free, open-source extension for BloodHound that models PingOne’s identity architecture and RBAC to discover and remediate identity-based attack paths. It explains core PingOne objects (organizations, environments, users, groups, applications, gateways, propagation stores) and demonstrates how role scoping and permissions can lead to abusable outcomes, outlining key abuse primitives such as password resets, group membership changes, role assignments, reading worker app secrets, creating gateway credentials, and extracting propagation store tokens for potential lateral movement.